TIDYELF
Description
(FireEye) TIDYELF is a dropper for the WINTERLOVE backdoor. WINTERLOVE has been observed embedded within a resource within TIDYELF. TIDYELF will load the main WINTERLOVE component by injecting it into the iexplore.exe process. It will then create a registry key named HKLM\SOFTWARE\RAT to store configuration data for WINTERLOVE components to use.
Names
| Name |
|---|
| TIDYELF |
Category
Malware
Type
- Dropper
Information
Other Information
Uuid
9a6d78d8-957d-4bfb-a6a2-2b8998b00b19
Last Card Change
2020-04-20